wallet-vulcan[.]xyz

This domain, wallet-vulcan.xyz, represents a high-severity credential harvesting operation specifically targeting Discord users. Analysis indicates the site impersonates Discord's authentication interface under the false pretense of a "Vulcan" login portal, attempting to deceive users into submitting valid credentials. The threat falls under the brand_impersonation category, where attackers replicate trusted service interfaces to exploit user trust and capture sensitive account information. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on October 07, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to IP address 104.21.12.174, hosted on Cloudflare's network (AS13335), which provides anonymization benefits to threat actors. Detection metrics show 12 out of 95 security engines on VirusTotal flagged the domain, while it appears on three distinct security blocklists. The SSL certificate (WE1) and page title "Login - Vulcan" further corroborate the phishing infrastructure designed to mimic legitimate authentication flows. Users who interacted with wallet-vulcan.xyz should immediately revoke any entered credentials through Discord's official account recovery process. All sessions associated with the compromised account must be terminated via Discord's security settings. Multi-factor authentication should be enabled if not already active, using app-based authenticators rather than SMS verification. Network administrators are advised to block the domain and associated IP (104.21.12.174) at perimeter security controls. Any systems used to access the site should undergo malware scans to detect potential secondary payloads or credential-stealing malware that may have been deployed during the phishing attempt.